Definition
Role-based access control, or RBAC, is a method of restricting system access to authorized users based on their role within an organization. Instead of assigning permissions to individual users, administrators assign permissions to specific roles, and then users are assigned to those roles. This simplifies access management and ensures that users only have the necessary privileges to perform their job functions, thereby enhancing security and reducing the risk of unauthorized access or data breaches. For example, a human resources department might create a 'Benefits Administrator' role with access to employee payroll and benefits information, while a general employee role would have no access to such sensitive data. Unlike attribute-based access control (ABAC) which uses dynamic attributes, RBAC relies on static role assignments. RBAC is a fundamental concept tested on CompTIA Security+, CySA+, and CISSP certifications.